Disapearing file ! - VMS

This is a discussion on Disapearing file ! - VMS ; I invoked mozilla from a SYS$LOGIN:MOZILLA.COM file. (it send escape sequence to the decterm to indicate this is a mozilla log window, makes sures all privileges are disabled (except tmpmbx, netmbx) and then calls the mozilla executable. SYS$LOGIN:MOZILLA.COM would therefore ...

+ Reply to Thread
Results 1 to 14 of 14

Thread: Disapearing file !

  1. Disapearing file !

    I invoked mozilla from a SYS$LOGIN:MOZILLA.COM file. (it send escape
    sequence to the decterm to indicate this is a mozilla log window, makes
    sures all privileges are disabled (except tmpmbx, netmbx) and then calls
    the mozilla executable.

    SYS$LOGIN:MOZILLA.COM would therefore remain open throughout the life of
    the session.

    Tonight, Mozilla crashed for some reason. When I tried to restart it
    from the same window (just uparrow to recall the @MOZILLA command), VMS
    told me that the file didn't exist.

    Indeed, the file MOZILLA.COM is gone.

    I immediatly tried DFU to undelete it. It didn't find it.

    I tried ana/disk/repair, it didn't find it.

    SEARCH INDEXF.SYS MOZILLA.COM reveals there is a MOZILLA.COM;5 on that
    disk.

    But DIR disk:[000000...]*mozilla*.com yields nothing.

    SHOW DEV/FILES/NOSYS does not show any mozilla.com (or any file with
    just file id and no filename).

    Now, if I had inadvertedly deleted MOZILLA.COM while it was in use, I
    can understand that it would have eventually been deleted when the image
    crashed and the command procedure would have exited. But since I ran DFU
    almost right away, shouldn't it have been able to recover it ?

    Does anyone know of a tool to report on a file found in INDEXF.SYS to
    dump all the data for that record and possibly dump the blocks
    associated with that file ? (perhaps the contents have not been
    overwitten even if allocated to another file ?)

  2. Re: Disapearing file !

    Addendum: Seems mozilla deleted far more than just one file.

    It would start, and list messages in a newsgroups, but couldn't display
    any of them because it had forgotten how to display message/rfc822
    messages ! And it was also incapable of HTTPS: transactions or unable to
    save messages either.

    If this message goes through, it means that re-installing Mozilla in the
    sys$common:[cswb] fixed the problem.

  3. Re: Disapearing file !

    JF Mezei wrote:
    > Addendum: #2


    I am again able to post to newsgroups.

    But HTTPS transactions still disabled. It pops an alert:

    This document cannot be displayed unless you install the Personal
    Security Manager (PSM)

    Download and install PSM and try again, or contact your system
    administrator.

    (so, here I go talkin to myself again :-(

    If they do port Firefox to VMS, I would suggest they remove every delete
    command from the source code.

  4. Re: Disapearing file !

    >...
    > Tonight, Mozilla crashed for some reason. When I tried to restart it from
    > the same window (just uparrow to recall the @MOZILLA command), VMS told me
    > that the file didn't exist.
    >...
    > SEARCH INDEXF.SYS MOZILLA.COM reveals there is a MOZILLA.COM;5 on that
    > disk.
    >
    > But DIR disk:[000000...]*mozilla*.com yields nothing.
    >...
    > Does anyone know of a tool to report on a file found in INDEXF.SYS to dump
    > all the data for that record and possibly dump the blocks associated with
    > that file ? (perhaps the contents have not been overwitten even if
    > allocated to another file ?)


    Is it possible that you have somehow executed the SET PROCESS/CASE=SENSITIVE
    command?

    What does DFU SEARCH disk/FILE=MOZILLA.COM/FULL tell you?

    Peter Weaver
    www.weaverconsulting.ca
    CHARON-VAX CHARON-AXP DataStream Reflection PreciseMail HP Commercial
    Hardware


  5. Re: Disapearing file !

    Peter Weaver wrote:
    > What does DFU SEARCH disk/FILE=MOZILLA.COM/FULL tell you?


    mc dfu search $11$dqb0:/file=MOZILLA.COM;5/full

    %DFU-I-SEARCH, Start search on $11$DQB0: ($11$DQB0

    %DFU-I-EOF, End of file INDEXF.SYS, Primary headers : 36712

    %DFU-S-FND , Files found : 0, Size : 0/0


    $ search/stat/window=0 $11$dqb0:[000000]indexf.sys mozilla.com
    $11$DQB0:[000000]INDEXF.SYS;1

    Files searched: 1 Buffered I/O count: 7
    Records searched: 41057 Direct I/O count: 324
    Characters searched: 21021184 Page faults: 18
    Records matched: 1 Elapsed CPU time: 0 00:00:00.76
    Lines printed: 1 Elapsed time: 0 00:00:08.56

  6. Re: Disapearing file !

    > Does anyone know of a tool to report on a file found in INDEXF.SYS to dump
    > all the data for that record and possibly dump the blocks associated with
    > that file ? (perhaps the contents have not been overwitten even if
    > allocated to another file ?)


    I did some checking and DFU SEARCH will not find a file if it has been
    deleted even if the record is in INDEXF.SYS. But if you download Fekko
    Stubbe's DIX (every VMS system should have DFU, DIX and Kermit installed as
    soon as possible) from http://oooovms.dyndns.org/ you can get all the
    information that INDEXF had about the file;

    $ DIX $11$dqb0:[000000]indexf.sys mozilla.com /DECWINDOWS

    From that you can get the LBN of the file then;

    $ DUMP /BLOCKS=(START:lbn1,END:lbn2) $11$dqb0:

    If the INDEXF.SYS record has not been overwritten yet and if the blocks have
    not been overwritten then you have your file back. But the chances of both
    still being there are slim on most systems.

    Peter Weaver
    www.weaverconsulting.ca
    CHARON-VAX CHARON-AXP DataStream Reflection PreciseMail HP Commercial
    Hardware


  7. Re: Disapearing file !

    Peter Weaver wrote:
    >> Stubbe's DIX (every VMS system should have DFU, DIX and Kermit installed as

    > soon as possible) from http://oooovms.dyndns.org/ you can get all the
    > information that INDEXF had about the file;


    Many , Many, Many thanks for this.

    Used TPU to edit INDEXF.SYS , located the MOZILLA.COM;5 record (line
    37073 :-) and then with DIX, I was able to get it to that record and
    display all the attributes.

    The map was there, but the dump command dumped what appears to be
    uuencode/mime jibberish, which means the contents of this file are truly
    gone. Maybe if I had had DIX yesterday and used it as soon as I had
    exited from mozilla, the blocks would have still been there (since
    mozilla would have locked that file while it was active).

    BTW, out of curiosity, if I had a file called:

    very_incriminating_picture_of_politician.jpg

    and I used DELETE/ERASE on that file, is it correct to state that the
    filename would remain stored in indexf.sys for a very long time even if
    the contents were no longer available ?

    (sometimes the actual file name is just as important to get rid of).

    Question:

    Can one use SEARCH to search the contents of a disk at the block level ?

    Question:

    Given a LBN on a disk, is there an easy way to find out to which file it
    belongs ? (in my case, I would like to know the creation date of the
    file that ended up overwriting my file)

  8. Re: Disapearing file !

    JF Mezei wrote:
    > Question:
    >
    > Given a LBN on a disk, is there an easy way to find out to which file it
    > belongs ? (in my case, I would like to know the creation date of the
    > file that ended up overwriting my file)


    DFU

    SEARCH

    /LBN
    /LBN=logical-block-number

    The /LBN option is a special qualifier which allows
    to find a file which contains a specific logical
    block number. Note that this qualifier cannot be
    combined with other search qualifiers (such as /FILE=).

    cu,
    Martin
    --
    One OS to rule them all | Martin Vorlaender | OpenVMS rules!
    One OS to find them | work: mv@pdv-systeme.de
    One OS to bring them all | http://vms.pdv-systeme.de/users/martinv/
    And in the Darkness bind them.| home: martin.vorlaender@t-online.de

  9. Re: Disapearing file !

    Martin Vorlaender wrote:
    > DFU
    > SEARCH
    > /LBN=logical-block-number



    Thanks. That is pretty cool. I found out that the file which overwrote
    my data was created today at 18:52.

    So I blame it all on Peter Weaver who posted the link to DIVX at
    20:54... If it had posted it earlier, I might have been able to recover
    that .COM file.... that was zapped 2 hours and 2 minutes before

    :-) ;-) :-) :-) ;-)

    Net time though, that information will come in really really handy !

  10. Re: Disapearing file !

    Hein RMS van den Heuvel wrote:
    > I don't get it. Earlier you indicated that you could not locate the
    > file with:
    >
    >>> $ search/stat/window=0 $11$dqb0:[000000]indexf.sys mozilla.com


    Nop, Search found it, but DFU UNDELETE/LIST didn't.


    > btw 1.. I use SEARCH/NUM/NON for such tasks.


    In my universe, SEARCH /NUMBERS for indexf.sys didn't print the number
    for that line, but it appears to be a bug in search because it does
    print numbers for earlier records.

    also, isn't /NUM/NON equivalent to /NUMBERS/NONUMBERS ?


  11. Re: Disapearing file !

    On Oct 29, 4:03 pm, JF Mezei wrote:
    > Hein RMS van den Heuvel wrote:
    >
    > > I don't get it. Earlier you indicated that you could not locate the
    > > file with:

    >
    > >>> $ search/stat/window=0 $11$dqb0:[000000]indexf.sys mozilla.com

    >
    > Nop, Search found it, but DFU UNDELETE/LIST didn't.
    >
    > > btw 1.. I use SEARCH/NUM/NON for such tasks.

    >
    > In my universe, SEARCH /NUMBERS for indexf.sys didn't print the number
    > for that line, but it appears to be a bug in search because it does
    > print numbers for earlier records.
    >
    > also, isn't /NUM/NON equivalent to /NUMBERS/NONUMBERS ?


    Do two wrongs make a right?

    Somehow I failed to see the 'records matched 1" on the first output
    provided.

    And yes, /NON is /NONUMBER.
    I meant /FORMAT=NONULL

    Hein.


  12. Re: Disapearing file !

    On Oct 28, 10:03 pm, JF Mezei wrote:

    > BTW, out of curiosity, if I had a file called:
    >
    > very_incriminating_picture_of_politician.jpg
    >
    > and I used DELETE/ERASE on that file, is it correct to state that the
    > filename would remain stored in indexf.sys for a very long time even if
    > the contents were no longer available ?


    I don't know the answer to that question, but it's simple to avoid the
    problem:

    $ RENAME incriminating.jpg innocent.jpg
    $ DELETE/ERASE innocent.jpg

    ok
    dpm


  13. Re: Disapearing file !

    In article <1193856924.931882.157860@19g2000hsx.googlegroups.c om>,
    "David P. Murphy" writes:
    > On Oct 28, 10:03 pm, JF Mezei wrote:
    >
    >> BTW, out of curiosity, if I had a file called:
    >>
    >> very_incriminating_picture_of_politician.jpg
    >>
    >> and I used DELETE/ERASE on that file, is it correct to state that the
    >> filename would remain stored in indexf.sys for a very long time even if
    >> the contents were no longer available ?

    >
    > I don't know the answer to that question, but it's simple to avoid the
    > problem:
    >
    > $ RENAME incriminating.jpg innocent.jpg
    > $ DELETE/ERASE innocent.jpg
    >
    > ok
    > dpm


    Which is why the FBI will take all your backups as well. Just ask
    Ollie North.

    bill


    --
    Bill Gunshannon | de-moc-ra-cy (di mok' ra see) n. Three wolves
    bill@cs.scranton.edu | and a sheep voting on what's for dinner.
    University of Scranton |
    Scranton, Pennsylvania | #include

  14. Re: Disapearing file !

    ----- Original Message -----
    From: "JF Mezei"
    To:
    Sent: Monday, October 29, 2007 1:55 AM
    Subject: Re: Disapearing file !


    > Martin Vorlaender wrote:
    >> DFU
    >> SEARCH
    >> /LBN=logical-block-number

    >
    >
    > Thanks. That is pretty cool. I found out that the file which overwrote my
    > data was created today at 18:52.
    >
    > So I blame it all on Peter Weaver who posted the link to DIVX at 20:54...
    > If it had posted it earlier, I might have been able to recover that .COM
    > file.... that was zapped 2 hours and 2 minutes before
    >
    > :-) ;-) :-) :-) ;-)
    >
    > Net time though, that information will come in really really handy !
    >


    Sorry, I don't get out to COV much these days since I don't have the time to
    wade through all the garbage posts to find real VMS questions.

    About your question regarding how long a filename could stay in indexf.sys.
    When I was checking using DIX on my system I had deleted a file on a lightly
    used disk and the filename was gone within about 5 minutes. I tried again on
    another disk and I saw filenames in there from files that were deleted weeks
    ago. So your incriminating filename not stay very long, or it may stay for
    hours/days or even longer.

    About your question on searching the contents of a disk at the block level.
    Could you use a combination of DUMP, PIPE and SEARCH?

    $ create dka300:[000000]mezei.txt
    jfmezei jfmezei jfmezei jfmezei jfmezei jfmezei jfmezei
    jfmezei jfmezei jfmezei jfmezei jfmezei jfmezei jfmezei
    $ dix/file dka300:[000000]indexf.sys mezei.txt ! show that the file takes
    blocks 13615560 to 13615594
    $ delete dka300:[000000]mezei.txt.
    $ pipe dump dka300:/block=(start:13615000,end:13615700)/width=132 | search
    sys$pipe jfmezei ! dump a range of blocks that include the blocks that were
    in the file

    You could dump the entire disk without using /BLOCK but I don't have that
    many hours to spend on this . The problem with this is that the search
    string must be on one line in the dump, using /WIDTH=132 helps though.

    BTW: You did not need to EDIT/TPU to find the record number;
    $ DIX $11$dqb0:[000000]indexf.sys mozilla.com /DECWINDOWS ! Would have found
    the first mozilla.com
    $ DIX/FILE $11$dqb0:[000000]indexf.sys mozilla.com /OUT=x.x ! Would have
    dumped all records with mozilla.com

    Peter Weaver
    www.weaverconsulting.ca
    CHARON-VAX CHARON-AXP DataStream Reflection PreciseMail HP Commercial
    Hardware


+ Reply to Thread